Security Compliance Review upon Request. Business Associate shall make its internal practices, books, and records, including policies and procedures relating to the security of Electronic PHI received from, created by or received by Business Associate on behalf of Covered Entity, available to the Covered Entity or to the Secretary of the United States Department of Health in Human Services or the Secretary’s designee, in a time and manner designated by the requester, for purposes of determining Covered Entity’s, Business Associate’s compliance with the Security Rule.
Security Compliance Review upon Request. Business Associate agrees to make its internal practices, books, and records, including policies and procedures relating to the security of EPHI received from, created by, or received by Business Associate on behalf of Covered Entity, available to the Covered Entity or to the Secretary, in a time and manner designated by the requester, for purposes of determining Covered Entity's or Business Associate's compliance with the Security Rule.
